{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,16]],"date-time":"2025-10-16T00:57:16Z","timestamp":1760576236435,"version":"build-2065373602"},"publisher-location":"New York, NY, USA","reference-count":88,"publisher":"ACM","funder":[{"name":"National Key Research and Development Program of China","award":["No. 2023YFC3321303"],"award-info":[{"award-number":["No. 2023YFC3321303"]}]},{"name":"National Natural Science Foundation of China","award":["62102218, 62302258"],"award-info":[{"award-number":["62102218, 62302258"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,10,28]]},"DOI":"10.1145\/3730567.3732915","type":"proceedings-article","created":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:39:24Z","timestamp":1760549964000},"page":"63-77","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Dive into the Cloud: Unveiling the (Ab)Usage of Serverless Cloud Function in the Wild"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-9204-111X","authenticated-orcid":false,"given":"Yijing","family":"Liu","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2163-6505","authenticated-orcid":false,"given":"Mingxuan","family":"Liu","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6774-5299","authenticated-orcid":false,"given":"Yiming","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9032-8063","authenticated-orcid":false,"given":"Baojun","family":"Liu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7896-3382","authenticated-orcid":false,"given":"Jia","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China and Quancheng Laboratory, Jinan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1811-9432","authenticated-orcid":false,"given":"Geng","family":"Hong","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0083-733X","authenticated-orcid":false,"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China and QI-ANXIN Technology Research Institute, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9714-5545","authenticated-orcid":false,"given":"Min","family":"Yang","sequence":"additional","affiliation":[{"name":"Fudan University, Shanghai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2025,10,15]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Adjustment of the distribution model for free trial quotas of cloud functions. 2023--12. https:\/\/cloud.tencent.com.cn\/document\/product\/583\/73739."},{"key":"e_1_3_2_1_2_1","volume-title":"O&M-free, pay-as-you-go, serverless computing platform. [n.d.]. https:\/\/www.alibabacloud.com\/en\/product\/function-compute. (Access in October","author":"Compute Aliyun Function","year":"2024","unstructured":"Aliyun Function Compute: A secure and stable, elastically scaled, O&M-free, pay-as-you-go, serverless computing platform. [n.d.]. https:\/\/www.alibabacloud.com\/en\/product\/function-compute. (Access in October, 2024)."},{"key":"e_1_3_2_1_3_1","volume-title":"https:\/\/terms.aliyun.com\/legalagreement\/terms\/suit_bu1_ali_cloud\/suit_bu1_ali_cloud201802281451_77479.html'spm=a2c4g.11186623.0.0.14686ad6jeyPNg. (Access","author":"Agreement Aliyun Service","year":"2024","unstructured":"Aliyun Service Agreement. [n.d.]. https:\/\/terms.aliyun.com\/legalagreement\/terms\/suit_bu1_ali_cloud\/suit_bu1_ali_cloud201802281451_77479.html'spm=a2c4g.11186623.0.0.14686ad6jeyPNg. (Access in October, 2024)."},{"key":"e_1_3_2_1_4_1","volume-title":"Amazon Simple Queue Service. https:\/\/aws.amazon.com\/sqs\/. (Access","year":"2024","unstructured":"Amazon. [n.d.]. Amazon Simple Queue Service. https:\/\/aws.amazon.com\/sqs\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_5_1","unstructured":"Announcing AWS Lambda Function URLs: Built-in HTTPS Endpoints for Single-Function Microservices. 2022-04. https:\/\/aws.amazon.com\/blogs\/aws\/announcing-aws-lambda-function-urls-built-in-https-endpoints-for-singlefunction- microservices\/."},{"key":"e_1_3_2_1_6_1","unstructured":"Attack and Defend: Leveraging AWS Serverless Technology for End-to-End C2. 2022--9. https:\/\/www.youtube.com\/watch?v=wl9GuvOFSKo."},{"key":"e_1_3_2_1_7_1","volume-title":"https:\/\/stackoverflow. com\/questions\/49810775\/aws-lambda-randomly-gives-back-502-as-status. (Access","author":"AWS","year":"2024","unstructured":"AWS Lambda randomly gives back 502 as status. [n.d.]. https:\/\/stackoverflow. com\/questions\/49810775\/aws-lambda-randomly-gives-back-502-as-status. (Access in October, 2024)."},{"key":"e_1_3_2_1_8_1","unstructured":"AWS Lambda: Run code without thinking about servers or clusters 2024--9. https:\/\/aws.amazon.com\/lambda\/."},{"key":"e_1_3_2_1_9_1","volume-title":"https:\/\/aws.amazon.com\/cn\/service-terms\/. (Access","author":"Service Terms AWS","year":"2024","unstructured":"AWS Service Terms. [n.d.]. https:\/\/aws.amazon.com\/cn\/service-terms\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_10_1","unstructured":"Azure Functions: Execute event-driven serverless code with an end-to-end development experience 2024--9. https:\/\/azure.microsoft.com\/en-us\/products\/functions."},{"key":"e_1_3_2_1_11_1","volume-title":"https:\/\/cloud.baidu.com\/doc\/CFC\/index. html. (Access","author":"Function Baidu Cloud","year":"2024","unstructured":"Baidu Cloud Function Compute [n.d.]. https:\/\/cloud.baidu.com\/doc\/CFC\/index. html. (Access in October, 2024)."},{"key":"e_1_3_2_1_12_1","volume-title":"User Rights and Obligations. [n.d.]. https:\/\/cloud.baidu.com\/doc\/Agreements\/s\/mjwvy1waw. (Access","author":"Service Agreement Baidu Cloud","year":"2024","unstructured":"Baidu Cloud Service Agreement: User Rights and Obligations. [n.d.]. https:\/\/cloud.baidu.com\/doc\/Agreements\/s\/mjwvy1waw. (Access in October, 2024)."},{"key":"e_1_3_2_1_13_1","volume-title":"Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses. 399--411","author":"Cable Jack","year":"2021","unstructured":"Jack Cable, Drew Gregory, Liz Izhikevich, and Zakir Durumeric. 2021. Stratosphere: Finding vulnerable cloud storage buckets. In Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses. 399--411."},{"key":"e_1_3_2_1_14_1","volume-title":"https:\/\/www.chinamobileltd.com\/en\/global\/home.php. (Access","author":"Mobile China","year":"2024","unstructured":"China Mobile. [n.d.]. https:\/\/www.chinamobileltd.com\/en\/global\/home.php. (Access in October, 2024)."},{"key":"e_1_3_2_1_15_1","volume-title":"https:\/\/www.chinatelecom-h.com\/en\/global\/home.php. (Access","author":"Telecom China","year":"2024","unstructured":"China Telecom. [n.d.]. https:\/\/www.chinatelecom-h.com\/en\/global\/home.php. (Access in October, 2024)."},{"key":"e_1_3_2_1_16_1","volume-title":"https:\/\/www.chinaunicom.com.cn\/. (Access","author":"Unicom China","year":"2024","unstructured":"China Unicom. [n.d.]. https:\/\/www.chinaunicom.com.cn\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_17_1","unstructured":"Cisco Umbrella Passive DNS. 2024--9. https:\/\/docs.umbrella.com\/investigate\/docs\/passive-dns."},{"key":"e_1_3_2_1_18_1","unstructured":"Cloud Functions (2nd gen) is now the default choice in the Google Cloud console user interface on August 29 2023. 2023-08. https:\/\/cloud.google.com\/functions\/docs\/release-notes#August_29_2023."},{"key":"e_1_3_2_1_19_1","unstructured":"Cloud Functions has released Cloud Functions on February 14 2022. 2022-02. https:\/\/cloud.google.com\/functions\/docs\/release-notes#February_14_2022(2ndgen)."},{"key":"e_1_3_2_1_20_1","unstructured":"Cloudflare 2024--9. https:\/\/www.cloudflare.com\/."},{"key":"e_1_3_2_1_21_1","unstructured":"CNCF Serverless Whitepaper v1.0 2018--9. https:\/\/github.com\/cncf\/wg-serverless\/tree\/master\/whitepapers\/serverless-overview."},{"key":"e_1_3_2_1_22_1","volume-title":"Proceedings of the 37th International Conference on Supercomputing. 373--385","author":"Copik Marcin","year":"2023","unstructured":"Marcin Copik, Roman B\u00f6hringer, Alexandru Calotoiu, and Torsten Hoefler. 2023. Fmi: Fast and cheap message passing for serverless functions. In Proceedings of the 37th International Conference on Supercomputing. 373--385."},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 2014 ACM Conference on SIGCOMM. 87--98","author":"Czyz Jakub","year":"2014","unstructured":"Jakub Czyz, Mark Allman, Jing Zhang, Scott Iekel-Johnson, Eric Osterweil, and Michael Bailey. 2014. Measuring ipv6 adoption. In Proceedings of the 2014 ACM Conference on SIGCOMM. 87--98."},{"key":"e_1_3_2_1_24_1","unstructured":"Datadog. 2023. The state of serverless. https:\/\/www.datadoghq.com\/state-ofserverless\/."},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 19th ACM Asia Conference on Computer and Communications Security. 112--127","author":"Davanian Ali","year":"2024","unstructured":"Ali Davanian, Michail Faloutsos, and Martina Lindorfer. 2024. C2Miner: Tricking IoT Malware into Revealing Live Command & Control Servers. In Proceedings of the 19th ACM Asia Conference on Computer and Communications Security. 112--127."},{"key":"e_1_3_2_1_26_1","volume-title":"2016 IEEE\/ACM Symposium on Edge Computing (SEC). IEEE, 109--110","author":"Lara Eyal De","year":"2016","unstructured":"Eyal De Lara, Carolina S Gomes, Steve Langridge, S Hossein Mortazavi, and Meysam Roodi. 2016. Hierarchical serverless computing for the mobile edge. In 2016 IEEE\/ACM Symposium on Edge Computing (SEC). IEEE, 109--110."},{"key":"e_1_3_2_1_27_1","volume-title":"https:\/\/cloud.ibm.com\/docs\/openwhisk?topic=openwhisk-dep-overview. (Access","author":"Deprecation","year":"2024","unstructured":"Deprecation overview. [n.d.]. https:\/\/cloud.ibm.com\/docs\/openwhisk?topic=openwhisk-dep-overview. (Access in October, 2024)."},{"key":"e_1_3_2_1_28_1","volume-title":"https:\/\/github.com\/americanexpress\/earlybird. (Access","year":"2024","unstructured":"EarlyBird. [n.d.]. https:\/\/github.com\/americanexpress\/earlybird. (Access in October, 2024)."},{"key":"e_1_3_2_1_29_1","volume-title":"The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes. In 2025 IEEE Symposium on Security and Privacy (SP)","author":"Yadmani Soufian El","unstructured":"Soufian El Yadmani, Olga Gadyatskaya, and Yury Zhauniarovich. 2024. The File That Contained the Keys Has Been Removed: An Empirical Analysis of Secret Leaks in Cloud Buckets and Responsible Disclosure Outcomes. In 2025 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 9--9."},{"key":"e_1_3_2_1_30_1","volume-title":"https:\/\/cloud.google.com\/functions\/docs\/configuring\/timeout. (Access","author":"Function","year":"2024","unstructured":"Function timeout. [n.d.]. https:\/\/cloud.google.com\/functions\/docs\/configuring\/timeout. (Access in October, 2024)."},{"key":"e_1_3_2_1_31_1","unstructured":"Function URL Overview. 2023-08. https:\/\/cloud.tencent.com\/document\/product\/583\/96099."},{"key":"e_1_3_2_1_32_1","volume-title":"https:\/\/cloud.google.com\/pubsub?hl=en. (Access","author":"Sub Google","year":"2024","unstructured":"Google. [n.d.]. Google Pub\/Sub. https:\/\/cloud.google.com\/pubsub?hl=en. (Access in October, 2024)."},{"key":"e_1_3_2_1_33_1","volume-title":"https:\/\/cloud.google.com\/terms\/. (Access","author":"SecOps Google Cloud","year":"2024","unstructured":"Google Cloud Platform\/SecOps Terms of Service. [n.d.]. https:\/\/cloud.google.com\/terms\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_34_1","unstructured":"Google Cloud Run Functions (formerly known as Cloud Functions) 2024--9. https:\/\/cloud.google.com\/functions."},{"key":"e_1_3_2_1_35_1","volume-title":"2018 IEEE 37th Symposium on Reliable Distributed Systems (SRDS). IEEE, 1--10","author":"Guo Run","year":"2018","unstructured":"Run Guo, Jianjun Chen, Baojun Liu, Jia Zhang, Chao Zhang, Haixin Duan, Tao Wan, Jian Jiang, Shuang Hao, and Yaoqi Jia. 2018. Abusing CDNs for fun and profit: Security issues in CDNs' origin validation. In 2018 IEEE 37th Symposium on Reliable Distributed Systems (SRDS). IEEE, 1--10."},{"key":"e_1_3_2_1_36_1","volume-title":"Proceedings of the International Conference on Internet of Things Design and Implementation. 225--236","author":"Hall Adam","year":"2019","unstructured":"Adam Hall and Umakishore Ramachandran. 2019. An execution model for serverless functions at the edge. In Proceedings of the International Conference on Internet of Things Design and Implementation. 225--236."},{"key":"e_1_3_2_1_37_1","volume-title":"8th USENIX workshop on hot topics in cloud computing (HotCloud 16)","author":"Hendrickson Scott","year":"2016","unstructured":"Scott Hendrickson, Stephen Sturdevant, Tyler Harter, Venkateshwaran Venkataramani, Andrea C Arpaci-Dusseau, and Remzi H Arpaci-Dusseau. 2016. Serverless computation with {OpenLambda}. In 8th USENIX workshop on hot topics in cloud computing (HotCloud 16)."},{"key":"e_1_3_2_1_38_1","volume-title":"https:\/\/www.virustotal.com\/gui\/home\/search. (Access","author":"Company Hispasec Sistemas","year":"2024","unstructured":"Hispasec Sistemas Company. [n.d.]. Virus Total. https:\/\/www.virustotal.com\/gui\/home\/search. (Access in October, 2024)."},{"key":"e_1_3_2_1_39_1","volume-title":"https:\/\/developer.aliyun.com\/ask\/571611. (Access","author":"How","year":"2024","unstructured":"How can the HTTP timeout for function computing be set to a longer duration? [n.d.]. https:\/\/developer.aliyun.com\/ask\/571611. (Access in October, 2024)."},{"key":"e_1_3_2_1_40_1","volume-title":"https:\/\/repost.aws\/knowledge-center\/lambdatroubleshoot-invoke-error-502--500. (Access","author":"How","year":"2024","unstructured":"How do I troubleshoot HTTP 502 and HTTP 500 status code (server-side) errors from AWS Lambda? [n.d.]. https:\/\/repost.aws\/knowledge-center\/lambdatroubleshoot-invoke-error-502--500. (Access in October, 2024)."},{"key":"e_1_3_2_1_41_1","volume-title":"https:\/\/www.163.com\/dy\/article\/F9UGKSLL051181GK.html. (Access","author":"How","year":"2024","unstructured":"How much do the top-ranking dating apps really make? Let's take a look at their profit-making tactics. [n.d.]. https:\/\/www.163.com\/dy\/article\/F9UGKSLL051181GK.html. (Access in October, 2024)."},{"key":"e_1_3_2_1_42_1","volume-title":"Functions-as-a-Service (FaaS) platform based on Apache OpenWhisk. [n.d.]. https:\/\/cloud.ibm.com\/functions\/. (Access","author":"Cloud Functions IBM","year":"2024","unstructured":"IBM Cloud Functions: Functions-as-a-Service (FaaS) platform based on Apache OpenWhisk. [n.d.]. https:\/\/cloud.ibm.com\/functions\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_43_1","unstructured":"Introduction of Kingsoft Function URL. 2022-08. https:\/\/docs.ksyun.com\/documents\/42034."},{"key":"e_1_3_2_1_44_1","unstructured":"Is there a risk in hiring someone to top up an OpenAI API account? Could the account be banned? 2024-04. https:\/\/chatgptboke.com\/is-there-any-risk-infinding-someone-to-recharge-openai-api.html."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"crossref","unstructured":"Wayne Jansen Tim Grance et al. 2011. Guidelines on security and privacy in public cloud computing. (2011).","DOI":"10.6028\/NIST.SP.800-144"},{"key":"e_1_3_2_1_46_1","volume-title":"Proceedings of the 2023 ACM Symposium on Cloud Computing. 443--458","author":"Joosen Artjom","year":"2023","unstructured":"Artjom Joosen, Ahmed Hassan, Martin Asenov, Rajkarn Singh, Luke Darlow, Jianfeng Wang, and Adam Barker. 2023. How does it function? characterizing long-term trends in production serverless workloads. In Proceedings of the 2023 ACM Symposium on Cloud Computing. 443--458."},{"key":"e_1_3_2_1_47_1","volume-title":"Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement. 153--167","author":"Jung Jaeyeon","year":"2001","unstructured":"Jaeyeon Jung, Emil Sit, Hari Balakrishnan, and Robert Morris. 2001. DNS performance and the effectiveness of caching. In Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement. 153--167."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"crossref","first-page":"102843","DOI":"10.1016\/j.jisa.2021.102843","article-title":"Denial of wallet\u2014defining a looming threat to serverless computing","volume":"60","author":"Kelly Daniel","year":"2021","unstructured":"Daniel Kelly, Frank G Glavin, and Enda Barrett. 2021. Denial of wallet\u2014defining a looming threat to serverless computing. Journal of Information Security and Applications 60 (2021), 102843.","journal-title":"Journal of Information Security and Applications"},{"key":"e_1_3_2_1_49_1","volume-title":"The menlo report: Ethical principles guiding information and communication technology research. Available at SSRN 2445102","author":"Kenneally Erin","year":"2012","unstructured":"Erin Kenneally and David Dittrich. 2012. The menlo report: Ethical principles guiding information and communication technology research. Available at SSRN 2445102 (2012)."},{"key":"e_1_3_2_1_50_1","volume-title":"2015 IEEE Symposium on Security and Privacy. IEEE, 880--896","author":"Kim Beom Heyn","year":"2015","unstructured":"Beom Heyn Kim and David Lie. 2015. Caelus: Verifying the consistency of cloud services with battery-powered devices. In 2015 IEEE Symposium on Security and Privacy. IEEE, 880--896."},{"key":"e_1_3_2_1_51_1","volume-title":"https:\/\/www.ksyun.com\/nv\/product\/KCF. (Access","author":"Kingsoft Cloud","year":"2024","unstructured":"Kingsoft Cloud Function [n.d.]. https:\/\/www.ksyun.com\/nv\/product\/KCF. (Access in October, 2024)."},{"key":"e_1_3_2_1_52_1","volume-title":"https:\/\/docs.ksyun.com\/documents\/42028?type=3. (Access","author":"Service Agreement Kingsoft Cloud","year":"2024","unstructured":"Kingsoft Cloud Service Agreement. [n.d.]. https:\/\/docs.ksyun.com\/documents\/42028?type=3. (Access in October, 2024)."},{"key":"e_1_3_2_1_53_1","volume-title":"Cloud penetration testing. arXiv preprint arXiv:1301.1912","author":"LaBarge Ralph","year":"2013","unstructured":"Ralph LaBarge and Thomas McGuire. 2013. Cloud penetration testing. arXiv preprint arXiv:1301.1912 (2013)."},{"key":"e_1_3_2_1_54_1","volume-title":"https:\/\/repost.aws\/questions\/QU85XAcFFZRR-xatC-RhwfAQ\/lambda-function-url-is-throwing-502. (Access","author":"Lambda Function URL","year":"2024","unstructured":"Lambda Function URL is throwing 502. [n.d.]. https:\/\/repost.aws\/questions\/QU85XAcFFZRR-xatC-RhwfAQ\/lambda-function-url-is-throwing-502. (Access in October, 2024)."},{"key":"e_1_3_2_1_55_1","volume-title":"Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 1541--1552","author":"Liao Xiaojing","year":"2016","unstructured":"Xiaojing Liao, Sumayah Alrwais, Kan Yuan, Luyi Xing, XiaoFeng Wang, Shuang Hao, and Raheem Beyah. 2016. Lurking malice in the cloud: Understanding and detecting cloud repository as a malicious service. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. 1541--1552."},{"key":"e_1_3_2_1_56_1","volume-title":"Proceedings of the 25th International Conference onWorld WideWeb. 321--332","author":"Liao Xiaojing","year":"2016","unstructured":"Xiaojing Liao, Chang Liu, Damon McCoy, Elaine Shi, Shuang Hao, and Raheem Beyah. 2016. Characterizing long-tail SEO spam on cloud web hosting services. In Proceedings of the 25th International Conference onWorld WideWeb. 321--332."},{"key":"e_1_3_2_1_57_1","volume-title":"20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23)","author":"Liu David H","year":"2023","unstructured":"David H Liu, Amit Levy, Shadi Noghabi, and Sebastian Burckhardt. 2023. Doing more with less: Orchestrating serverless applications without an orchestrator. In 20th USENIX Symposium on Networked Systems Design and Implementation (NSDI 23). 1505--1519."},{"key":"e_1_3_2_1_58_1","volume-title":"Proceedings of the 37th Annual Computer Security Applications Conference. 930--943","author":"Liu Mingxuan","year":"2021","unstructured":"Mingxuan Liu, Yiming Zhang, Baojun Liu, Zhou Li, Haixin Duan, and Donghong Sun. 2021. Detecting and characterizing SMS spearphishing attacks. In Proceedings of the 37th Annual Computer Security Applications Conference. 930--943."},{"key":"e_1_3_2_1_59_1","volume-title":"Understand the Ecosystem of Chinese Ticket Grabbing Apps. In 33rd USENIX Security Symposium (USENIX Security 24)","author":"Liu Yijing","year":"2024","unstructured":"Yijing Liu, Yiming Zhang, Baojun Liu, Haixin Duan, Qiang Li, Mingxuan Liu, Ruixuan Li, and Jia Yao. 2024. Tickets or Privacy? Understand the Ecosystem of Chinese Ticket Grabbing Apps. In 33rd USENIX Security Symposium (USENIX Security 24). 5107--5124."},{"key":"e_1_3_2_1_60_1","volume-title":"https:\/\/krebsonsecurity.com\/2025\/01\/mastercard-dns-error-went-unnoticed-for-years\/. (Access","author":"Error Went MasterCard DNS","year":"2025","unstructured":"MasterCard DNS Error Went Unnoticed for Years [n.d.]. https:\/\/krebsonsecurity.com\/2025\/01\/mastercard-dns-error-went-unnoticed-for-years\/. (Access in March, 2025)."},{"key":"e_1_3_2_1_61_1","volume-title":"https:\/\/www.mcafee.com\/en-us\/safe-browser\/mcafee-webadvisor.html. (Access","author":"Webadvisor McAfee","year":"2024","unstructured":"McAfee Webadvisor. [n.d.]. https:\/\/www.mcafee.com\/en-us\/safe-browser\/mcafee-webadvisor.html. (Access in October, 2024)."},{"key":"e_1_3_2_1_62_1","volume-title":"2017 IEEE 37th International Conference on Distributed Computing Systems Workshops (ICDCSW). IEEE, 405--410","author":"McGrath Garrett","year":"2017","unstructured":"Garrett McGrath and Paul R Brenner. 2017. Serverless computing: Design, implementation, and performance. In 2017 IEEE 37th International Conference on Distributed Computing Systems Workshops (ICDCSW). IEEE, 405--410."},{"key":"e_1_3_2_1_63_1","volume-title":"Modern hierarchical, agglomerative clustering algorithms. arXiv preprint arXiv:1109.2378","author":"M\u00fcllner Daniel","year":"2011","unstructured":"Daniel M\u00fcllner. 2011. Modern hierarchical, agglomerative clustering algorithms. arXiv preprint arXiv:1109.2378 (2011)."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"crossref","unstructured":"Antonio Nappa Zhaoyan Xu M Zubair Rafique Juan Caballero and Guofei Gu. 2014. CyberProbe: Towards Internet-Scale Active Detection of Malicious Servers.. In NDSS.","DOI":"10.14722\/ndss.2014.23218"},{"key":"e_1_3_2_1_65_1","volume-title":"https:\/\/www.oracle.com\/cloud\/cloud-native\/functions\/. (Access","author":"Oracle Cloud","year":"2024","unstructured":"Oracle Cloud Functions [n.d.]. https:\/\/www.oracle.com\/cloud\/cloud-native\/functions\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_66_1","unstructured":"Passive DNS historical internet database: Farsight DNSDB. 2024--9. https:\/\/www.farsightsecurity.com\/solutions\/dnsdb\/."},{"key":"e_1_3_2_1_67_1","volume-title":"https:\/\/en.qianxin.com\/. (Access","author":"The Official Cyber Security QAX","year":"2024","unstructured":"QAX - The Official Cyber Security Services and Anti-Virus Software Sponsor of the Olympic and Paralympic Winter Games Beijing 2022. [n.d.]. https:\/\/en.qianxin.com\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_68_1","unstructured":"Serverless Cloud Computing: Are there actually No Servers? 2023-06. https:\/\/chaoskyle.com\/serverless-cloud-computing."},{"key":"e_1_3_2_1_69_1","volume-title":"https:\/\/www.linkedin.com\/pulse\/serverless-cloud-function-market-data-dive-research-analysis-paazc\/. (Access","author":"Function Market Serverless Cloud","year":"2024","unstructured":"Serverless Cloud Function Market. [n.d.]. https:\/\/www.linkedin.com\/pulse\/serverless-cloud-function-market-data-dive-research-analysis-paazc\/. (Access in October, 2024)."},{"key":"e_1_3_2_1_70_1","unstructured":"ServerlessC2. 2022--9. https:\/\/github.com\/hackerob\/ServerlessC2."},{"key":"e_1_3_2_1_71_1","unstructured":"Mohammad Shahrad Rodrigo Fonseca Inigo Goiri Gohar Chaudhry Paul Batum Jason Cooke Eduardo Laureano Colby Tresness Mark Russinovich and Ricardo Bianchini. 2020. Serverless in the wild: Characterizing and optimizing the serverless workload at a large cloud provider. In 2020 USENIX annual technical conference (USENIX ATC 20). 205--218."},{"key":"e_1_3_2_1_72_1","volume-title":"Proceedings of the 21st International Middleware Conference. 1--13","author":"Silva Paulo","year":"2020","unstructured":"Paulo Silva, Daniel Fireman, and Thiago Emmanuel Pereira. 2020. Prebaking functions to warm the serverless cold start. In Proceedings of the 21st International Middleware Conference. 1--13."},{"key":"e_1_3_2_1_73_1","volume-title":"Quantitative analysis of cloud function evolution in the AWS serverless application repository. arXiv preprint arXiv:1905.04800","author":"Spillner Josef","year":"2019","unstructured":"Josef Spillner. 2019. Quantitative analysis of cloud function evolution in the AWS serverless application repository. arXiv preprint arXiv:1905.04800 (2019)."},{"key":"e_1_3_2_1_74_1","volume-title":"Claus Pahl, and Jan Raphael Schmid Niederkofler.","author":"Taibi Davide","year":"2020","unstructured":"Davide Taibi, Nabil El Ioini, Claus Pahl, and Jan Raphael Schmid Niederkofler. 2020. Patterns for serverless functions (function-as-a-service): A multivocal literature review. (2020)."},{"key":"e_1_3_2_1_75_1","volume-title":"https:\/\/cloud.tencent.com\/document\/product\/583\/59194. (Access","author":"Cloud Function Service Agreement Tencent Serverless","year":"2024","unstructured":"Tencent Serverless Cloud Function Service Agreement. [n.d.]. https:\/\/cloud.tencent.com\/document\/product\/583\/59194. (Access in October, 2024)."},{"key":"e_1_3_2_1_76_1","volume-title":"https:\/\/www.tencentcloud.com\/products\/scf. (Access","author":"Cloud Functions Tencent Serverless","year":"2024","unstructured":"Tencent Serverless Cloud Functions. [n.d.]. https:\/\/www.tencentcloud.com\/products\/scf. (Access in October, 2024)."},{"key":"e_1_3_2_1_77_1","unstructured":"Top 5 Serverless Platforms That Take Off. 2022--12. https:\/\/www.techmagic.co\/blog\/top-serverless-platforms."},{"key":"e_1_3_2_1_78_1","unstructured":"Top Serverless Platforms in 2023. 2023--10. https:\/\/chrisbateson80.medium.com\/top-serverless-platforms-in-2023--2fde4104441d."},{"key":"e_1_3_2_1_79_1","volume-title":"Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems. 559--572","author":"Ustiugov Dmitrii","year":"2021","unstructured":"Dmitrii Ustiugov, Plamen Petrov, Marios Kogias, Edouard Bugnion, and Boris Grot. 2021. Benchmarking, analysis, and optimization of serverless function snapshots. In Proceedings of the 26th ACM International Conference on Architectural Support for Programming Languages and Operating Systems. 559--572."},{"key":"e_1_3_2_1_80_1","volume-title":"18th USENIX conference on file and storage technologies (FAST 20)","author":"Zhang Jingyuan","year":"2020","unstructured":"AoWang, Jingyuan Zhang, Xiaolong Ma, Ali Anwar, Lukas Rupprecht, Dimitrios Skourtis, Vasily Tarasov, Feng Yan, and Yue Cheng. 2020. {InfiniCache}: exploiting ephemeral serverless functions to build a {cost-effective} memory cache. In 18th USENIX conference on file and storage technologies (FAST 20). 267--281."},{"key":"e_1_3_2_1_81_1","unstructured":"Liang Wang Mengyuan Li Yinqian Zhang Thomas Ristenpart and Michael Swift. 2018. Peeking behind the curtains of serverless platforms. In 2018 USENIX annual technical conference (USENIX ATC 18). 133--146."},{"key":"e_1_3_2_1_82_1","unstructured":"Warning on Unauthorised Investment Firm\/Investment Business Firm issued. 2018--10. https:\/\/www.centralbank.ie\/news\/article\/warning-on-unauthorisedinvestment-firm-investment-business-firm-issued8Oct2018."},{"key":"e_1_3_2_1_83_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Wei Mingkui","year":"2021","unstructured":"Mingkui Wei. 2021. Domain Shadowing: Leveraging Content Delivery Networks for Robust {Blocking-Resistant} Communications. In 30th USENIX Security Symposium (USENIX Security 21). 3327--3343."},{"key":"e_1_3_2_1_84_1","volume-title":"https:\/\/en.wikipedia.org\/wiki\/ChatGPT. (Access","author":"Wikipedia","year":"2024","unstructured":"Wikipedia of ChatGPT [n.d.]. https:\/\/en.wikipedia.org\/wiki\/ChatGPT. (Access in October, 2024)."},{"key":"e_1_3_2_1_85_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Xie Qinge","year":"2022","unstructured":"Qinge Xie, Shujun Tang, Xiaofeng Zheng, Qingran Lin, Baojun Liu, Haixin Duan, and Frank Li. 2022. Building an Open, Robust, and Stable {Voting-Based} Domain Top List. In 31st USENIX Security Symposium (USENIX Security 22). 625--642."},{"key":"e_1_3_2_1_86_1","volume-title":"Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 955--969","author":"Xiong Junjie","year":"2021","unstructured":"Junjie Xiong, Mingkui Wei, Zhuo Lu, and Yao Liu. 2021. Warmonger: inflicting denial-of-service via serverless functions in the cloud. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security. 955--969."},{"key":"e_1_3_2_1_87_1","volume-title":"Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 521--534","author":"Zhang Yiming","year":"2020","unstructured":"Yiming Zhang, Baojun Liu, Chaoyi Lu, Zhou Li, Haixin Duan, Shuang Hao, Mingxuan Liu, Ying Liu, DongWang, and Qiang Li. 2020. Lies in the air: Characterizing fake-base-station spam ecosystem in china. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 521--534."},{"key":"e_1_3_2_1_88_1","volume-title":"Security and privacy in cloud computing: A survey. In 2010 sixth international conference on semantics, knowledge and grids","author":"Zhou Minqi","unstructured":"Minqi Zhou, Rong Zhang, Wei Xie, Weining Qian, and Aoying Zhou. 2010. Security and privacy in cloud computing: A survey. In 2010 sixth international conference on semantics, knowledge and grids. IEEE, 105--112."}],"event":{"name":"IMC '25:ACM Internet Measurement Conference","location":"Madison WI USA","sponsor":["SIGMETRICS ACM Special Interest Group on Measurement and Evaluation","SIGCOMM ACM Special Interest Group on Data Communication","USENIX"]},"container-title":["Proceedings of the 2025 ACM Internet Measurement Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3730567.3732915","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,15]],"date-time":"2025-10-15T17:41:30Z","timestamp":1760550090000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3730567.3732915"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,15]]},"references-count":88,"alternative-id":["10.1145\/3730567.3732915","10.1145\/3730567"],"URL":"https:\/\/doi.org\/10.1145\/3730567.3732915","relation":{},"subject":[],"published":{"date-parts":[[2025,10,15]]},"assertion":[{"value":"2025-10-15","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}